Managed Detection & Response (MDR)

Our Managed Detection and Response (MDR) Basis Service already includes far more than comparable services offered by our competitors. It includes all technologies and services for comprehensive DETECTION, ANALYSIS and RESPONSE of cyber attacks based on event log data, threat intelligence feeds and cyber deception.

• 24/7 Cyber Detection & Response Center: Our Cyber Detection & Response Center (CDRC) is where true 24/7 monitoring of your systems takes place. Our analysts are on duty for you around the clock, 365 days a year, to detect cyber attacks on your company at an early stage, analyze them and defend against them in a targeted manner. Our 24/7 service keeps “Mean Time to Detect” (MTTD) to a minimum.
• Security Orchestration, Automation & Response (SOAR): To reduce alarm processing time, SECUINFRA deploys a Security Orchestration, Automation & Response system (SOAR). With its help, analyses and reactions are partially automated. In this way, we reduce the “Mean Time to Respond” (MTTR) to a minimum so that, in the event of a successful cyber attack, we can stop the attacker as early as possible and avert greater damage.
• Threat Intelligence: SECUINFRA uses strategic threat intelligence to select detection mechanisms and operationalizes threat intelligence data as part of threat hunting to uncover previously undetected attacks.
• Use-Case Library
• Security Information & Event Management (SIEM): The SIEM system is used to centralize all security-related log entries and events from third-party sources (e.g. anti-virus, IDS, EDR). Numerous use cases developed by SECUINFRA since 2010 in the areas of threat detection, user and entity behavior analytics (UEBA) and optionally machine learning are applied.
• Central log management: The database for the SIEM area is provided by our central log management. Security-related log data is collected centrally and stored in a searchable manner for a period of 60 days.
• Cyber Deception: With Cyber Deception, we deceive cyber criminals to identify their activities in their infrastructure. To do this, we smuggle specially prepared resources such as shares, accounts or supposed access data into your IT environment. In the attacker’s attempt to spy on your IT (Reconnaissance), to spread further (Lateral Movement) and to extend privileges (Privilege Escalation), sooner or later he will inevitably resort to the specially prepared resources. Since they are not used elsewhere, their use is a very clear sign that an attacker is on the network. This information flows into the central SIEM system as alarms with a very high priority.

However, should a major security incident occur, SECUINFRA provides support with the following services, which are billed on a time and material basis:

• Incident Management: In the event of major cyberattacks, professional coordination and communication is essential to contain and manage the attack. That’s where our incident response experts come in to help you with technical and non-technical challenges.
• Compromise Assessment: In the event of a cyber attack, it is extremely important to answer the question as quickly and reliably as possible: Which systems have been compromised? Our Compromise Assessment answers this question as quickly, efficiently and reliably as possible.
• Digital Forensics: Digital forensics enables detailed analysis and reconstruction of security incidents. Our goal here is to learn from the cyberattack and refine your defenses. In addition, the findings of our digital forensics experts enable prosecution and help you make claims against cyber risk insurance companies.
• Malware analysis: As part of malware analysis, we examine how malware works with the goal of gaining comprehensive insight into how it operates, understanding its potential impact on a system, and identifying appropriate measures for future mitigation and prevention. Our malware analysts use both static and dynamic analysis as well as reverse engineering.
  

Endpoint-based detection and response against cyber attacks is one of the most important pillars of modern cyber detection & response and is an optimal complement to log data-based attack detection.

Our Managed Detection & Response Service BASIS+ therefore includes the following services:

• Endpoint Detection & Response (EDR): Endpoint Detection & Response (EDR) systems form the technological basis for modern detection and defense against cyber attacks. To detect attacks on endpoints (workstations & server systems), SECUINFRA uses established EDR technologies for behavior-based detection of anomalies on endpoints. In addition to the pure detection of cyber attacks, EDR also offers the possibility to actively react to detected attacks. For example, processes can be terminated, local user accounts can be locked or entire systems can be isolated automatically. This helps to further reduce Mean Time to Respond (MTTR) by stopping a successful cyberattack at the most common entry point of a cyberattack, the endpoint.

The MDR Complete service adds the pillars of endpoint-based cyber attack detection and response and log data-based attack detection to the pillar of network-based cyber attack detection and defense. This provides you with comprehensive detection, analysis and defense against cyber attacks and puts you in an excellent position in this area.

• Network Intrusion Detection System (N-IDS): The traditional N-IDS is a network traffic virus scanner that detects attacker behavior based on signatures. Using traditional N-IDS, our analysts detect the transmission and use of known malware, as well as access to the command-and-control infrastructure of known attackers.
• Network Detection & Response (NDR): In addition to the classic Network IDS, SECUINFRA offers behavior-based detection of attackers at the network level. This uses an advanced Network Detection & Response (NDR) system that, unlike traditional products such as N-IDS, relies on behavioral pattern detection. The data generated is not only extremely valuable for detecting attacks, but is also used by our analysts as part of the response process to contextualize suspicious events. In addition to attack detection and contextualization capabilities, our NDR also provides the ability to actively respond to detected attacks. For example, communication relationships can be terminated, access to command and control servers can be blocked, or IT systems can be isolated automatically to minimize the impact of detected security incidents.

Our MDR Premium Service complements our comprehensive MDR Complete Service for detecting, analyzing and defending against cyber attacks with Vulnerability Management, which is important for compliance reasons.

• Vulnerability Management: Known vulnerabilities are often not closed because there is no overview of the current patch status and new vulnerabilities. This is where our Vulnerability Management Service comes in. We check your systems for known vulnerabilities and provide you with consolidated results.

In addition to the comprehensive detection, analysis and defense against cyber attacks from our MDR Complete service and vulnerability management, which is important for compliance reasons, we support you with our MDR Premium+ service in reducing the risk of successful phishing attacks on your company:

• Anti Phishing: Phishing is one of the main gateways for successful cyber attacks. The risk can be reduced through various measures such as employee education and awareness, as well as technical protection measures such as anti-spam solutions, browser extensions and sandboxes. Nevertheless, it happens again and again that suspicious e-mails reach the employees and they have to decide whether to open the attachment, click on the link or rather delete the suspicious e-mail. Wouldn’t it be very helpful to have experts at your side at all times when making this potentially momentous decision? This is exactly where SECUINFRA’s anti-phishing service comes in. In case of suspicious mails, your employees forward them to our experts via phishing button. They check the mails from an expert’s point of view and give your employees a prompt answer: phishing or legitimate.